The cyber attack was against CEVA Logistics; this is the company that ships the steam hardware in Europe. CEVA retains this information for up to 90 days after orders ship.

Compromised information includes name, address, country, phone number, and email address associated with your steam account.

Lots of people hate on Steam, but I don't think this is their fault.